The "minimum necessary" rule

Q:Under what conditions may I use, disclose, or request an entire medical record?

A: The privacy rules don't prohibit you from using, disclosing, or requesting an entire medical record. But, in so doing, you are bound by the "minimum necessary" rule, which mandates that you disclose or request the minimum information necessary to get the job done.

There are a number of exceptions to this rule, however. First, you are permitted to share a patient's entire medical record with any provider participating in that patient's care.

Second, you can provide the entire record to a patient who is the subject of that record. For example, if she requests a copy of her record for the purpose of obtaining life insurance, you aren't required to determine what exactly in the file is applicable to the life insurance application and what's not.

The other exceptions to the minimum necessary rule are:

• when a patient has authorized it

• to comply with the HIPAA administrative simplification rules

• when the Department of Health and Human Services requires disclosure for enforcement purposes under the privacy rule

• when it's required by other laws

Your privacy compliance plan should include written policies and procedures that spell out which employees are authorized to see the entire record. Since all employees in a small medical practice typically need such access, you should be sure to document this fact. For all other circumstances, determination of whether disclosure of the entire record is necessary should be conducted on a case-by-case basis.